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March 22, 2019 Gregory J. Bautista 

914.872.7839 (direct) 
Gregory. B autista @ wilsonelser. com 


Attorney General Brian E. Frosh 

Office of the Attorney General 
Identity Theft Unit 
200 St. Paul Place 
Baltimore, Maryland 21202 
Idtheft@oag.state.md.us 

Re: Data Security Incident 


Dear Attorney General Frosh: 

We represent Tower Legal Solutions (“TLS”) with respect to an incident involving the potential exposure 
of certain personal information described in detail below. 

1. Nature of the possible security breach or unauthorized use or access 

On February 19, 2019, TLS discovered that employees’ personal information may have been obtained by 
an unknown, unauthorized third party as the result of a phishing attack. After identifying unusual activity 
surrounding an employee’s email account, TLS immediately engaged computer forensic experts to 
determine whether information in the accounts was at risk. The investigation determined that an intruder 
gained access to the employee’s account, and could have viewed documents that contained employees’ 
names, addresses and Social Security numbers. 

2. Number of Maryland residents potentially affected 

Approximately sixty-four (64) Maryland residents were affected in this potential incident. TLS sent the 
potentially impacted individuals a letter notifying them of this incident on March 22, 2019. A copy of the 
notification sent to the potentially impacted individuals is included with this letter, which informs these 
Maryland residents about the 12 months of credit monitoring and identity theft protection services that is 
being offered to them. 

3. Steps TLS has taken relating to the potential incident 

Upon learning of this issue, TLS immediately engaged computer forensic experts to determine whether 
information in the account was at risk, and took steps to identify anyone potentially impacted by this 
incident. TLS has also taken steps to prevent a similar event from occurring in the future, including 
reviewing and revising their information security policies, resetting employees’ access credentials to ensure 

1133 Westchester Avenue * White Plains, NY 10604 * p 914.323.7000 * f 914.323.7001 

Albany ■ Atlanta * Austin * Baltimore * Beaumont * Boston * Chicago * Dallas * Denver * Edwardsville ■ Garden City * Hartford * Houston ■ hdiono * Kentucky 
Las Vegas + London * Las Angela * Miami + Wiehigon ♦ Milwaukee * Missouri + New Jersey + New Orleans + New York * Orlando + Philadelphia * Phoenix 
San Diego * San Frondsco * Sarasota * SlamMa * Virginia * Washington. DC + Wellington * white Plains 

wikonelser.com 


7456602v. 1 




- 2 - 


WILSON ELSER 

fcllSON IL-SCR Md S K DW iTJ IDCl-WaN A. DICKER LLP 


their systems are secure and implementing multi-factor authentication to their email environment for 
internal staff. 

4. Other notification and contact information 

If you have any additional questions, please contact me at Gregory.Bautista@wilsonelser.com or 
(914) 872-7839. 


Very truly yours, 
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TOWER 

LEGAL SOLUTIONS 


65 Broadway, Suite 1703 | New York, NY 10006 
T: 212.430.6300 | www.towerls.com 


March 22, 2019 

«Name 1» 

«Address 1» 

«Address 2» 

<<City»«State»<<Zip» 


Dear «Name 1»: 


We are writing to inform you of an incident that may have resulted in the disclosure of your name and Social Security 
number. As an employee of Tower Legal Solutions, we take the security of your information very seriously and sincerely 
apologize for any inconvenience this incident may cause. 

On February 19, 2019, we discovered that your personal information, including your name and Social Security number may 
have been obtained by an unknown, unauthorized third party as the result of a phishing attack. After identifying unusual 
activity surrounding an employee’s email account, we immediately engaged computer forensic experts to determine whether 
information in the account was at risk. Our investigation determined that an intruder gained access to the employee’s 
account and could have viewed documents that contained your name, address and Social Security number. While we did 
not identify specific activity around your information, we are sending you this letter out of an abundance of caution to 
provide you with resources you can use to protect yourself. 

Please note, although we are not aware of any misuse of your information, we have retained CyberScout, an identity theft 
education and resolution specialist, to provide you with Single Bureau Credit Monitoring and Triple Bureau Credit 
Report 1 services at no cost to you. These services provide you with alerts for 12 months from the date of enrollment when 
changes occur to your Experian credit file. This notification is sent to you the same day that the change or update takes 
place with the bureau. In addition, we are providing you with proactive fraud assistance to help with any questions that you 
might have or in event that you become a victim of fraud. To enroll in these free services, please log on to 
https://www.myidmanager.com and follow the instructions provided. When prompted, please provide the following 
unique code to receive services: <CODE HERE> 

We sincerely apologize and regret any inconvenience that this incident may cause you and remain dedicated to protecting 
your personal information. In addition, we have taken steps to prevent a similar event from occurring in the future, including 
reviewing and revising our policies and resetting employees’ access credentials to ensure our systems are secure. 


Should you have any questions or concerns, or to obtain additional information about the free services described above, 
please call the CyberScout help line at 1-800-405-6108 and provide the fraud specialist with your unique code. 


Sincerely, 



Tony Valencia 

Director of Human Resources 


1 These services require an internet connection and e-mail account and may not be available to minors under the age of 18 years of age. Please note 
that when signing up for monitoring services, you may be asked to verify personal information for your own protection to confirm your identity. 
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Additional Important Information 


For residents of Hawaii, Michigan, Missouri North Carolina and Virginia: It is recommended by state law that you remain vigilant for 
incidents of fraud and identity theft by reviewing credit card account statements and monitoring your credit report for unauthorized 
activity. 

For residents of Illinois, Maryland, MissouriNorth Carolina, Oregon, and West Virginia: It is required by state laws to inform you that you 
may obtain a copy of your credit report, free of charge, whether or not you suspect any unauthorized activity on your account. You 
may obtain a free copy of your credit report from each of the three nationwide credit reporting agencies. To order your free credit 
report, please visit www.annualcreditreport.com, or call toll-free at 1-877-322-8228. You can also order your annual free credit report by mailing 
a completed Annual Credit Report Request Form (available at https://www.consumer.ftc.gov/articles/0155-free-credit-reports) to: Annual Credit 
Report Request Service, P.O. Box 105281, Atlanta, GA, 30348-5281. 

For residents of Oregon: 

State laws advise you to report any suspected identity theft to law enforcement, including the Attorney General, and the Fede ral Trade 
Commission. 

For residents of Illinois, Maryland, North Carolina and Rhode Island: 

You can obtain information from the Maryland and North Carolina Offices of the Attorney General andthe FederalTrade Commission 
about fraud alerts, security freezes, and steps you can take toward preventing identity theft. 


Maryland Office of the 
Attorney General 

Consumer Protection Division 
200 St. Paul Place 
Baltimore, MD 21202 
1-888-743-0023 
www.oag.state.md.us 


Rhode Island Office of the 
Attorney General 

Consumer Protection 
150 South Main Street 
Providence Rl 02903 
1-401-274-4400 
www.riag.ri.gov 


North Carolina Office of the 
Attorney General 

Consumer Protection Division 
9001 Mail Service Center 
Raleigh, NC 27699-9001 
1-877-566-7226 
www.ncdoi.com 


Federal Trade Commission 

Consumer Response Center 
600 Pennsylvania Ave, NW 
Washington, DC 20580 
1-877-IDTHEFT (438-4338) 
www.ftc.gov/idtheft 


For residents of all states: 


Fraud Alerts: You can place fraud alerts with the three credit bureaus by phone and online with Equifax 
(https://assets.equifax.com/assets/personal/Fraud_Alert_Request_Form.pdf) or Experian (https://www.experian.com/fraud/center.html). A fraud 
alert tells creditors to follow certain procedures, including contacting you, before they open any new accounts or change your existing accounts. For 
that reason, placing a fraud alert can protect you, but also may delay you when you seek to obtain credit. As of September 21, 2018, initial fraud 
alerts last for one year. Victims of identity theft can also get an extended fraud alert for seven years. The phone numbers for all three credit bureaus 
are at the bottom of this page. 

Monitoring: You should always remain vigilant and monitor your accounts for suspicious or unusual activity. 

Security Freeze: You also have the right to place a security freeze on your credit report. A security freeze is intended to prevent credit, loans, and 
services from being approved in your name without your consent. To place a security freeze on your credit report, you need to make a request to 
each consumer reporting agency. You may make that request by certified mail, overnight mail, regular stamped mail, or by following the instructions 
found at the websites listed below. The following information must be included when requesting a security freeze (note that if you are requesting a 
credit report for your spouse or a minor under the age of 16, this information must be provided for him/her as well): (1) full name, with middle initial 
and any suffixes; (2) Social Security number; (3) date of birth; (4) current address and any previous addresses for the past five years; and (5) any 
applicable incident report or complaint with a law enforcement agency or the Registry of Motor Vehicles. The request must also include a copy of a 
government-issued identification card and a copy of a recent utility bill or bank or insurance statement. It is essential that each copy be legible, 
display your name and current mailing address, and the date of issue. As of September 21, 2018, it is free to place, lift, or remove a security freeze. 
You may also place a security freeze for children under the age of 16. You may obtain a free security freeze by contacting a ny one or more of the 
following national consumer reporting agencies: 

Equifax Security Freeze Experian Security Freeze Transllnion (FVAD) 

P.O. Box 105788 P.O. Box 9554 P.O. Box 2000 

Atlanta, GA 30348 Allen, TX 75013 Chester, PA 19022 

www.freeze.equifax.comwww.experian.com/freezefreeze.transunion.com 
800-525-6285 888-397-3742 800-680-7289 

More information can also be obtained by contacting the Federal Trade Commission listed above. 
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